The strategic opportunity and national security threat of connected cars

European debate over Chinese connected cars largely focuses on the industrial challenges: Chinese cars are rapidly gaining market share, jeopardising millions of European auto jobs and the continent’s industrial base, and generally posing an existential threat to its auto industry. China, on the other hand, treats connected cars as a security exposure on its roads, placing particular scrutiny on foreign manufacturers. 

This reflects how Chinese authorities view the technology: as both a strategic opportunity and a national security risk. On one hand, connected and autonomous vehicles are seen as a way to climb the innovation ladder, advance civil-military integration, and strengthen indigenous capabilities such as the BeiDou navigation satellite system. On the other hand, they are viewed as potential vectors for large-scale data harvesting and cyber intrusions, exposing critical vulnerabilities if left insufficiently controlled. 

This dual posture has real-world consequences, including an enforcement mindset. China is rapidly emerging as a global leader in connected and autonomous vehicles, with an approach shaped by both aggressive innovation and equally assertive regulation. 

What connected cars can do and how China manages the risks 

A modern connected vehicle is a sensor platform, a cloud service, and a remotely updateable computer network. You likely park it outside your home and regularly drive it past critical infrastructure.

Exterior cameras, remote sensors, and radars capture faces, licence plates, streetscapes, and facility perimeters. Interior sensors can collect voices, behavioural patterns, and biometric data. The risk is not only ‘hacking’ in the Hollywood sense. It is also aggregation: millions of small, mundane data points add up to a strategic dataset.

China’s own regulators have been unusually explicit about this. In Beijing’s framing, connected vehicles have an ‘inherent advantage’ in acquiring and aggregating geographic information over long periods and wide areas. Chinese local regulatory documents also specify in detail what data connected vehicles collect and how it should be classified according to its potential impact on national security. Data is not treated uniformly; instead, it is tiered based on the risks associated with its exposure.

At the highest level of sensitivity, authorities identify datasets whose leakage would pose a direct threat to state security. These include, for example, traffic patterns around military zones and government facilities, maps of sensitive zones, as well as large-scale datasets covering more than 100,000 individuals. Such data is classified as highly sensitive because it can reveal operational patterns, infrastructure usage, and broader socio-economic activities. This classification logic reflects a broader principle in Chinese policy: the value – and risk – of data is determined not only by its content, but by the insights that can be derived from it at scale.

Since at least 2017, Beijing has built one of the world’s most comprehensive regulatory systems governing how connected vehicles collect, store, and transmit data. Chinese law restricts the export of sensitive vehicle data, mandates domestic storage, and requires cybersecurity management systems across the vehicle’s entire lifecycle. It also pushes manufacturers toward formal data-security certification.

Crucially, this certification is highly operational. Testing protocols specify what compliance looks like in practice: anonymisation of external visual data (such as faces and licence plates), strict limits on exporting in-cabin personal data, default-off settings for in-cabin data collection, clear user notifications for personal-data processing, and constraints on the precision and range of sensors such as cameras and radars. In this model, what data is collected – and how it is handled – is not merely defined in principle, but systematically verified through testing.

And how does China police the connected-car risk in practice? The country’s handling of Tesla offers a concrete glimpse. Even though China’s data-security assessment is theoretically voluntarily, before Tesla cleared it in April 2024, its vehicles were informally restricted from driving or parking near locations deemed sensitive: government buildings, military facilities, some airports and motorways, and areas linked to events involving senior Chinese Communist Party leaders. Only after the assessment did Elon Musk announce that his cars would be permitted in more places across China.

Europe’s patchwork: rules exist, verification is still uneven

All of this matters for Europe, because Chinese brands are no longer a marginal presence on its roads. In the first half of 2025, their combined market share in Europe nearly doubled. And by year’s end, industry-tracking data put Chinese-brand sales in Europe at roughly 810,000 vehicles and 6.1% market share. 

So how does EU regulation compare? At present, it has the language of rights, risk, and safeguards. It also has regulatory building blocks that touch the connected-car problem: GDPR, which governs personal data processing; the Data Act, including provisions aimed at limiting certain third-country government access in cloud contexts; NIS2, which raises cybersecurity obligations across sectors; type-approval and vehicle cybersecurity management expectations anchored in UNECE R155 (cybersecurity) and UNECE R156 (software updates). The European Commission is also moving to close the regulatory gap – issuing a risk assessment of connected vehicles, an ICT Supplychain Toolbox, and signalling that connected cars will be brought into the scope of the Cybersecurity Act’s forthcoming revision.

But in practice there is still a gap between formal requirements and verification. A connected vehicle can be formally compliant and still be built around opaque vendor chains, remote management pathways, and data flows that regulators struggle to inspect at scale. In that context, asking consumers to trust privacy settings is not policy. It is abdication.

What EU regulation should look like

Europe’s best move at this point is not a blanket ban on Chinese vehicles. It is to build capacity: the ability to test, audit, and enforce what connected vehicles do, where data goes, who can access it, how updates are signed, and how remote functions can be invoked. Here, examining China’s own risk assessments and solutions could be very useful. 

Three practical concrete steps would help the EU begin to tackle this problem.

First, the EU should mandate technical audits for connected vehicles. This must not consist solely of paper compliance, but include actual inspection of data flows, update chains, remote administration interfaces, and supplier components. China’s automotive-data testing notices show how granular compliance can be when regulators demand measurable performance (like anonymisation effectiveness) rather than promises. 

Second, authorities must define enforceable sensitive-area controls. Like drones, connected cars should be treated as potential collection platforms, not just consumer products – meaning they should be barred from entering designated sensitive zones (such as around military bases, critical energy sites, and government buildings) unless they meet higher assurance requirements and can be verified as compliant under inspection. China’s geospatial-security framing makes clear why states worry about everyday mapping becoming strategic collection. 

Third, Europe should use cybersecurity regulation as industrial policy. If Europe requires higher assurance, it will advantage suppliers and integrators who can meet those standards – many of whom are European. 

The real choice

Europe can keep treating Chinese connected cars as a trade irritant, or it can treat them as what they are: mobile nodes in a world-wide digital ecosystem.

The hard part is not writing another regulation. The hard part is building enforcement machinery that can keep pace with a fleet that is always updating and always collecting data.

The EU must now move from principles to proof, ensuring that ‘privacy’ and ‘cybersecurity’ are not just slogans but measurable, testable conditions for operating on European roads. Here Beijing’s own logic becomes a rationale for the careful strengthening of European safeguards.

This article is based on a longer report ‘Smartphones on wheels: Connected cars from China and the EU’s cybersecurity’, published by the Centre for Eastern Studies (OSW).